{"id":49178,"date":"2025-04-25T16:39:08","date_gmt":"2025-04-25T16:39:08","guid":{"rendered":"https:\/\/www.devopsschool.com\/blog\/?p=49178"},"modified":"2025-07-12T05:54:53","modified_gmt":"2025-07-12T05:54:53","slug":"limitation-with-openshift-with-docker-images-compare-to-vanilla-kubernetes","status":"publish","type":"post","link":"https:\/\/www.devopsschool.com\/blog\/limitation-with-openshift-with-docker-images-compare-to-vanilla-kubernetes\/","title":{"rendered":"Limitation with OpenShift with Docker Images compare to Vanilla Kubernetes"},"content":{"rendered":"\n

Let me explain very clearly<\/strong>, so you fully understand why some images work, some don’t<\/strong> in OpenShift \ud83d\ude80:<\/p>\n\n\n\n

\n\n\n\n

\ud83c\udfaf Big Picture: OpenShift Is Different<\/em> from Vanilla Kubernetes<\/h1>\n\n\n\n
Topic<\/th>Kubernetes<\/th>OpenShift<\/th><\/tr><\/thead>
Can run root containers?<\/td>\u2705 Allowed by default<\/td>\u274c Not allowed by default (Security!)<\/td><\/tr>
Need special non-root images?<\/td>\u274c No<\/td>\u2705 Yes, or modify yourself<\/td><\/tr>
Handles normal Docker images easily?<\/td>\u2705 Yes<\/td>\ud83d\udfe1 Sometimes extra care needed<\/td><\/tr>
Focus<\/td>Flexible<\/td>Secure by Design<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

\u2705 OpenShift enforces Security Context Constraints (SCC)<\/strong>
\u2705 OpenShift forces containers to run non-root<\/strong> by default.<\/p>\n\n\n\n

\n\n\n\n

\ud83d\udee0 Why nginx-unprivileged worked but others failed?<\/h1>\n\n\n\n
Image<\/th>Why it Worked \/ Failed<\/th><\/tr><\/thead>
nginxinc\/nginx-unprivileged<\/code><\/td>\u2705 Built specifically to run as non-root<\/strong>, listens on 8080<\/strong><\/td><\/tr>
registry.redhat.io\/rhscl\/nginx-116-rhel7<\/code><\/td>\ud83d\uded1 It’s a S2I base image<\/strong>, not runnable<\/strong> directly<\/td><\/tr>
nginx:latest<\/code> (official)<\/td>\ud83d\uded1 Tries to bind port 80, needs root<\/td><\/tr>
bitnami\/nginx<\/code><\/td>\u2705 Works if you map to 8080<\/td><\/tr>
Any random DockerHub NGINX<\/td>\ud83d\uded1 Fails unless it listens >1024 and runs non-root<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n

\ud83d\udccb The 3 Problems You Face with Most Docker Images in OpenShift<\/h1>\n\n\n\n
Issue<\/th>Why Happens<\/th>How to Solve<\/th><\/tr><\/thead>
Image expects to run as root<\/td>OpenShift blocks root by default<\/td>Use non-root images (unprivileged<\/code>) or modify Dockerfile<\/td><\/tr>
Image tries to bind port 80<\/td>Only root can bind ports <1024<\/td>Configure container to listen on 8080 or higher<\/td><\/tr>
Image is an S2I base (not normal app)<\/td>Meant for building apps, not direct run<\/td>Use oc new-app<\/code> + --strategy=source<\/code> or use proper image<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\n\n\n\n

\ud83e\udde0 In simple words:<\/h1>\n\n\n\n
    \n
  • Normal Kubernetes<\/strong>: You can pull almost any DockerHub image and it runs.<\/li>\n\n\n\n
  • OpenShift<\/strong>: You must care about non-root and correct ports<\/strong>, or your app won’t run.<\/li>\n<\/ul>\n\n\n\n
    \n\n\n\n

    \ud83d\ude80 How to Choose Images for OpenShift:<\/h1>\n\n\n\n

    \u2705 Prefer images labeled as “OpenShift Ready”<\/strong>, “non-root”, or “unprivileged”.
    \u2705 If using random DockerHub images:<\/p>\n\n\n\n

      \n
    • Make sure they don’t require root user.<\/li>\n\n\n\n
    • Make sure they listen on port >1024 (like 8080, 8443).<\/li>\n<\/ul>\n\n\n\n

      \u2705 For NGINX specifically:<\/p>\n\n\n\n

        \n
      • Use nginxinc\/nginx-unprivileged<\/code><\/strong> (best for OpenShift).<\/li>\n\n\n\n
      • Or customize your own nginx Dockerfile<\/strong> to listen on port 8080 and remove user nginx;<\/code> line.<\/li>\n<\/ul>\n\n\n\n
        \n\n\n\n

        \ud83d\udd25 Quick Visual:<\/h1>\n\n\n\n
        Image Type<\/th>Works Directly in OpenShift?<\/th>Extra Work Needed?<\/th><\/tr><\/thead>
        nginxinc\/nginx-unprivileged<\/td>\u2705 Yes<\/td>No<\/td><\/tr>
        bitnami\/nginx<\/td>\u2705 Mostly<\/td>Adjust port sometimes<\/td><\/tr>
        nginx:latest<\/td>\u274c No<\/td>Must modify (port, user)<\/td><\/tr>
        registry.redhat.io\/rhscl\/nginx-116-rhel7<\/td>\ud83d\uded1 Not direct<\/td>Use S2I build process<\/td><\/tr>
        Your own custom Docker image<\/td>\ud83d\uded1 If root<\/td>Modify to non-root<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
        \n\n\n\n

        \ud83d\udce2 Final Cheat Sheet for You<\/h1>\n\n\n\n
        What to Check<\/th>Why Important<\/th><\/tr><\/thead>
        Running user (root or non-root)<\/td>OpenShift only allows random high UID (non-root)<\/td><\/tr>
        Listening Port<\/td>Must be >1024 (8080, 8443, etc.)<\/td><\/tr>
        Image type<\/td>Is it runnable app image or just a S2I builder base?<\/td><\/tr>
        OpenShift SCCs (Security Context Constraints)<\/td>Forces strict security on containers<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
        \n\n\n\n

        \u2728 In one line:<\/h1>\n\n\n\n

        In OpenShift, containers must be non-root, non-privileged, and ports >1024 \u2014 otherwise they fail!<\/strong><\/p>\n\n\n\n

        \n\n\n\n

        \ud83d\ude80 Bonus<\/h1>\n\n\n\n

        Would you also like me to give you:<\/p>\n\n\n\n

          \n
        • \ud83d\udce6 How to convert any Docker image<\/strong> into OpenShift-ready by adjusting Dockerfile?<\/li>\n\n\n\n
        • \ud83d\udd25 Full tutorial: Best practices for building OpenShift-compliant containers<\/strong>?<\/li>\n<\/ul>\n\n\n\n

          <\/p>\n\n\n\n

          \n\n\n\n

          <\/p>\n","protected":false},"excerpt":{"rendered":"

          Let me explain very clearly, so you fully understand why some images work, some don’t in OpenShift \ud83d\ude80: \ud83c\udfaf Big Picture: OpenShift Is Different from Vanilla Kubernetes Topic Kubernetes OpenShift… <\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"_joinchat":[],"footnotes":""},"categories":[5153],"tags":[],"class_list":["post-49178","post","type-post","status-publish","format-standard","hentry","category-openshift"],"_links":{"self":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49178","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/comments?post=49178"}],"version-history":[{"count":1,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49178\/revisions"}],"predecessor-version":[{"id":49179,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/posts\/49178\/revisions\/49179"}],"wp:attachment":[{"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/media?parent=49178"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/categories?post=49178"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.devopsschool.com\/blog\/wp-json\/wp\/v2\/tags?post=49178"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}